Skip to Content (Press Enter)

Skip to Nav (Press Enter)

Effective, Experienced, Exceptional.

Firm Profile

Data Breach

Subscribe to Consumer Finance

Thank you for your desire to subscribe to Severson & Werson’s Consumer Finance Weblog. In order to subscribe, you must provide a valid name and e-mail address. This too will be retained on our server. When you push the “subscribe button”, we will send an electronic mail to the address that you provided asking you to confirm your subscription to our Weblog. By pushing the “subscribe button”, you represent and warrant that you are over the age of 18 years old, are the owner/authorized user of that e-mail address, and are entitled to receive e-mails at that address. Our weblog will retain your name and e-mail address on its server, or the server of its web host. However, we won’t share any of this information with anyone except the Firm’s employees and contractors, except under certain extraordinary circumstances described on our Privacy Policy and (About The Consumer Finance Blog/About the Appellate Tracker Weblog) Page. NOTICE AND AGREEMENT REGARDING E-MAILS AND CALLS/TEXT MESSAGES TO LAND-LINE AND WIRELESS TELEPHONES: By providing your contact information and confirming your subscription in response to the initial e-mail that we send you, you agree to receive e-mail messages from Severson & Werson from time-to-time and understand and agree that such messages are or may be sent by means of automated dialing technology. If you have your email forwarded to other electronic media, including text messages and cellular telephone by way of VoIP, internet, social media, or otherwise, you agree to receive my messages in that way. This may result in charges to you. Your agreement and consent also extend to any other agents, affiliates, or entities to whom our communications are forwarded. You agree that you will notify Severson & Werson in writing if you revoke this agreement and that your revocation will not be effective until you notify Severson & Werson in writing. You understand and agree that you will afford Severson & Werson a reasonable time to unsubscribe you from the website, that the ability to do so depends on Severson & Werson’s press of business and access to the weblog, and that you may still receive one or more emails or communications from weblog until we are able to unsubscribe you.

District Court (Cal.) Finds Factual Question of Whether Data Breach Proximately Caused Loss of Cryptocurrency, But No Basis for Restitution under B&P Code 17200

by Scott J. Hyman |

In Fraser v. Mint Mobile, LLC, No. C 22-00138 WHA, 2022 U.S. Dist. LEXIS 76772, at *2 (N.D. Cal. Apr. 27, 2022), Judge Alsup denied summary judgment to a defendant claiming that its data breach did not proximately cause the Plaintiff's cryptocurrency loss.  The facts were as follows: Defendant Mint Mobile, LLC is a mobile virtual network operator that currently… Read More

Simply continuing to share PI after a relationship ends does not, by itself, result in a violation of CCPA

by Genevieve R. Walser-Jolly |

In Danfer-Klaben v. JPMorgan Chase Bank, N.A., No. SACV 21-262 PSG (JDEx), 2022 U.S. Dist. LEXIS 25553, at *16-17 (C.D. Cal. Jan. 24, 2022), Judge Gutierrez in the Central District of California held that: The CCPA provides relief to "any consumer whose nonencrypted and nonredacted personal information . . . is subject to an unauthorized access . . . or… Read More

District Court (Ohio) Says Criminal Data Hack Was Not Supervening Cause Entitling Business to Summary Judgment in Data Breach Case

by Scott J. Hyman |

In In re Sonic Corp. Customer Data Sec. Breach Litig., No. 1:17-md-2807, 2021 U.S. Dist. LEXIS 168504, at *13-16 (N.D. Ohio Sep. 7, 2021), Judge Gwin denied summary judgment to the defendants, who argued that the criminal hacking constituted a supervening cause. Here, Sonic can only prevail by showing that the hackers' criminal acts were independent of Sonic's negligent security… Read More

District Court (Ohio) Says Data Breach Response Information in Sonic Hack Won’t Be Sealed Because of Interest to the Public (and the Court)

by Scott J. Hyman |

In In re Sonic Corp. Customer Data Sec. Breach Litig. Fin. Insts., No. 1:17-md-2807, 2021 U.S. Dist. LEXIS 142001, at *5-6 (N.D. Ohio July 30, 2021), Judge Gwin refused to seal some of the data breach investigation from the Sonic data breach hack. In 2017, unidentified third parties accessed Sonic customers' payment card data. The hackers obtained customer payment card… Read More

District Court (Pa.) Says Cybersecurity Consultant’s Report Post-Data Breach Is Not Protected by Privilege

by Scott J. Hyman |

In In re Rutter's Data Sec. Breach Litig., No. 1:20-CV-382, 2021 U.S. Dist. LEXIS 136220, at *2 (M.D. Pa. July 22, 2021), Judge Mahalchick ordered production of an investigative report from a cybersecurity consultant prepared in response to a data breach. Now before the Court is a discovery dispute regarding the production of an investigative report which was created after… Read More

District Court (Cal.) says Plaintiffs are Entitled to Discovery on German Defendant’s Claim re Lack of Personal Jurisdiction. Under a Negligence Claim, the Sensitive Nature of Data Held By A Dating App Carried Plaintiffs over the Pleading Threshold for a Duty of Care and the Fact that the Breach Occurred was Sufficient to Plead the Element of Breach.

by Genevieve R. Walser-Jolly |

On January 28, 2021, Judge Alsup, in the Northern District of California, denied in part and granted in part Defendants' Motion to Dismiss.  Flores-Mendez et al v. Zoosk, Inc. et al. (N.D. CA; 3:20-cv-04929-WHA). Zoosk, a dating app, is a subsidiary of Spark.  Spark's principal place of business is in Berlin.  Spark filed a 12(b)(2) motion challenging the Court's personal… Read More

District Court (Cal.) Says CCPA Data Breach Claims Still Subject to Art. III Standing Requirements Where Information Obtained Lacks the Degree of Sensitivity Required by the Ninth Circuit to Establish Injury in Fact

by Genevieve R. Walser-Jolly |

On January 12, 2021, Judge David O. Carter granted Marriott’s Motion to Dismiss and dismissed the case, including Plaintiffs’ CCPA claim based on lack of standing.  Rahman v. Marriott International, Inc., et al.  (C.D. CA; 8:20-cv-00654), here, “Plaintiff alleges that class members were victims of a cybersecurity breach at Marriott when two employees of a Marriott franchise in Russia accessed… Read More

District Court (D.C.) Says Law Firm’s Investigation into Cybersecurity Breach Not Protected from Discovery by Privilege; Orders Production of Effect of Hack on Law Firm’s Other Clients

by Scott J. Hyman |

In Wengui v. Clark Hill, Civil Action No. 19-3195 (JEB), 2021 U.S. Dist. LEXIS 5395 (D.D.C. Jan. 12, 2021), Judge B0asberg ordered production of internal investigation reports regarding a cybersecurity breach, which were not protected by the attorney client or work product privileges. Malicious cyberattacks have unfortunately become a routine part of our modern digital world. So have the lawsuits… Read More

District Court (Mich.) Orders Data Breach Class Action’s Representatives to Arbitration Despite Named Plaintiffs’ Status as Minors at the Time of On-Line Contracting

by Scott J. Hyman |

In In re StockX Customer Data Sec. Breach Litig., No. 19-12441, 2020 U.S. Dist. LEXIS 241178 (E.D. Mich. Dec. 23, 2020), Judge Roberts ordered the class representative’s claims to arbitration, despite the fact that they were minors when they signed the Terms of Service containing the Arbitration Clause. This action arises from a data breach to StockX's system which occurred… Read More

District Court (Cal.) Allows Data Breach Class Action to Proceed

by Scott J. Hyman |

In Stasi v. Inmediata Health Grp. Corp., No. 19cv2353 JM (LL), 2020 U.S. Dist. LEXIS 217097 (S.D. Cal. Nov. 19, 2020), Judge Miller allowed a data security breach class action to proceed.  The basis of the class action was as follows: According to Plaintiffs' FAC,1 Inmediata provides billing and health record software and service solutions to healthcare providers. (FAC ¶¶… Read More

District Court (Cal.) Tosses Data Breach Class Action for Wont of Standing

by Scott J. Hyman |

In Holly v. Alta Newport Hosp., Inc., No. 2:19-cv-07496-ODW (MRWx), 2020 U.S. Dist. LEXIS 195652 (C.D. Cal. Oct. 21, 2020), Judge Wright dismissed a data breach class action because the class representative could not demonstrate compensable loss. Holly alleges that she suffered "emotional harm and distress and has been injured in her mind and body." (SAC ¶ 49.) She also… Read More

Department of Treasury Says Paying Off Ransomware May Run the Risk of Sanctions

by Scott J. Hyman |

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued an advisory yesterday, alerting companies who engage with victims of ransomware attacks of potential sanctions risks for facilitating ransomware payments.  This advisory highlights OFAC’s designations of malicious cyber actors and those who facilitate ransomware transactions under its cyber-related sanctions program. It identifies U.S. government resources for reporting… Read More

District Court (Va.) Finds that Company’s Data Breach Consultant’s Report Was Not Entitled to Work Product Protection

by Scott J. Hyman |

In In re Capital One Consumer Data Sec. Breach Litig., No. 1:19md2915 (AJT/JFA), 2020 U.S. Dist. LEXIS 91736, at *5-9 (E.D. Va. May 26, 2020), Judge Anderson found that a consultant's report prepared in connection with a data breach was not entitled to work product protection and must be turned over to the Plaintiffs. The facts were as follows: On… Read More

District Court (Cal.) Allows Data Breach Claim to Proceed

by Scott J. Hyman |

In In re Solara Med. Supplies, LLC Customer Data Sec. Breach Litig., No. 3:19-cv-2284-H-KSC, 2020 U.S. Dist. LEXIS 80736 (S.D. Cal. May 7, 2020), Judge Huff allowed a data breach claim to proceed. The facts were as follows: On November 13, 2019, Solara Medical Supplies, LLC ("Solara") notified its customers of a security incident that may have compromised the information… Read More

District Court (Cal.) Tosses Nationwide Data Breach Class Action Due to Lack of Injury in Fact

by Scott J. Hyman |

In Stasi v. Inmediata Health Grp. Corp., No. 19cv2353 JM (LL), 2020 U.S. Dist. LEXIS 79303, at *1-4 (S.D. Cal. May 5, 2020), Judge Miller dismissed a nationwide identity theft/data breach class action. The facts were as follows: Plaintiffs allege that in January of 2019, Inmediata learned it was experiencing a large "data security incident" resulting in the exposure of… Read More

Severson & Werson Attorneys Publish a Litigator’s Look at What Constitutes a “Reasonable Security Procedure” Under the California Consumer Privacy Act

by Elizabeth C. Farrell |

The CCPA went live on January 1, 2020, creating a cause of action and potential liability of between $100 to $750 per person for a data breach deriving from a business' failure to maintain reasonable policies and procedures.  Unfortunately, the CCPA does not define the term "reasonable".  While compliance lawyers and consultants properly have been advising their clients to shore… Read More

District Court (Cal.) Certifies Injunctive Data Breach Class Against Facebook, but Denies Certification of Damages Class

by Scott J. Hyman |

In Adkins v. Facebook, Inc., No. C 18-05982-WHA, 2019 U.S. Dist. LEXIS 206271 (N.D. Cal. Nov. 26, 2019), Judge Alsup granted in part and denied in part a data breach class. This is a putative class action by plaintiff Stephen Adkins against defendant Facebook, Inc. Plaintiff asserts a claim for negligence based on Facebook's alleged faulty security practices in collecting… Read More

District Court (Cal.) Says California’s Data Breach Statute’s Element of “Failing to Implement Reasonable Security Procedures and Practices” Cannot Be Generally Pleaded

by Scott J. Hyman |

In Anderson v. Kimpton Hotel & Rest. Grp., LLC, No. 19-cv-01860-MMC, 2019 U.S. Dist. LEXIS 133869, at *13-14 (N.D. Cal. Aug. 8, 2019), Judge Chesney dismissed a data breach claim under California's data breach statute, Civil Code 1798.81.5.  The facts were as follows: In their complaint, plaintiffs [*2]  allege "Kimpton uses an online reservation system that facilitates the booking of hotel… Read More

District Court (Fla.) Says Data Breach Victims Meet Spokeo Art. III Standards

by Scott J. Hyman |

In re Brinker Data Incident Litig., No. 3:18-cv-686-J-32MCR, 2019 U.S. Dist. LEXIS 128573 (M.D. Fla. Aug. 1, 2019), Judge Corrigan allowed a data-breach class action to proceed.  Hackers accessed Brinker's data network and installed malware on point-of-sale ("POS") systems at many Chili's restaurants, which Brinker owns, develops, operates, and franchises.  Brinker publicly announced the breach on May 12, 2018, stating: ”On May… Read More

1 2